text:
Hear how UFC welterweight Brian Melancon is preparing for his upcoming bout in Indy and what you can do to follow in his footwork.
Welterweight Brian Melancon (7-2) opened eyes at UFC 162 with a first-round KO in his UFC debut against TUF alum Seth Baczynski. Next up for the 31-year-old Texan: undefeated TUF 17 winner Kelvin Gastelum on August 28 at UFC Fight Night: Condit vs. Kampmann 2.
In between workouts, Melancon spends his days tending to
patients as a physical therapist, a gig he says helps him remain in
sync with his body and training. "Being a physical therapist has helped me learn when to listen to my
body, when to push through, and when I'm just sore and need
rest," he says. "If I do need to rest, I know how to
rehab the area as best as possible while getting the maximum out of the
rest of my body."
Melancon's two-a-day training routines typically add up to three to four hours per day, split between an a.m. and p.m. session that incorporates pad work, wrestling, and strength and conditioning.
"I'll work some wrestling-specific techniques and defensive skills, drill it, wrestle for a while, then do some pad work," he says. "A couple days per week we'll spar, working in some rounds and drills of position-specific sparring from the bottom, top, ground and pound, and against the cage. My strength and conditioning workouts are sort of CrossFit-style."
With five knockouts on his resume, the well-rounded Melancon credits a scrutinized approach to his standup game with enabling him to score those finishes. Whether you're a beginner or a pro athlete, here are his tips for perfecting your striking arsenal.
#1. Know Your Body
"Use what works best for your body type and your set of skills. If you look at what I do it's not perfectly technical according to, say, K-1 kickboxing standards. But it's effective for me, and I've adapted certain things to make my shots count as I set up combos. So if you don't have quick footwork and can't dance around and get away from shots, that is not [a] good [strategy] to use. You can add that in [later], if you are able to make it fit for you."
#2. Keep Your Head Moving
"Obviously, it's harder to hit a moving target, so keep your head moving."
#3 Perfect Your Timing
"Knockouts come when you throw the right shot at the right time. So you need to know when to throw a shot, not just throw it whenever."
#4. Get Inspired
"I watched a ton of tape of other fighters with my body type and style. And I saw the combos they landed and I tried to put them into my sparring. Sometimes it doesn't quite work for me, so we move on. My coaches and I constantly try to evolve and add to my striking."
#5. Do Footwork Drills
"Being able to move and evade shots ties into setting up shots and making angles."
UFC Performance Institute
Dana White On The Opening Of UFC PI Mexico


text:
They had me at drawing on heroes and villains from the X-Men's past, present and future. Then they lost me.
Gree has an image problem — most of its big-name games are just a collection of images with numbers assigned so they can battle each other. Collectible cards, without the actual cards. I've dabbled, but I'm not a really big fan.
Marvel seems delighted, at least.
"We are delighted to be working with GREE to help celebrate the 50th anniversary of X-Men," said Andreea Enache-Thune, senior vice president games and digital distribution at Marvel via official press release. "By teaming up with GREE, a leader in mobile gaming, we are confident that fans around the world will enjoy this exciting new way to experience and connect with X-Men."
At least the game has ties to an upcoming X-Men comic book event, and not something that happened years ago that we're just now getting to. I applaud the initiative, though shouldn't we have announced this a couple of days ago?

subset: commoncrawl


text:
• shtick •
Pronunciation: shtik • Hear it!
Part of Speech: Noun
Meaning: 1. An entertainment routine, a gimmick or gag associated with someone in particular. 2. A sphere of interest or expertise, bailiwick.
Notes: Today's is another Yiddish word that seems to have stuck in English. It is still spelled variously: schtick and schtik are both reported by the Oxford English Dictionary. Our spelling above seems to be the dominant current orthography. This word is a lexical orphan with no derivational relatives.
In Play: The American comedian Jack Benny's schticks included his stinginess and lying about his age (always 39). Chico Marx's shtick was his fake Italian accent while his brother Harpo's was not speaking at all but rather honking a horn to get attention. Bud Abbot and Lou Costello did a famous baseball shtick (routine) called 'Who's on First?' The meaning of shtick has now expanded to No. 2 above: "I would love to help with your car, Lenny, but motors just aren't my shtick."
Word History: As already mentioned, today's Good Word is another contribution to English by the Yiddish language. Yiddish picked the word up from German Stück "piece" from Old High German stukki "crust, fragment". Where OHG stukki came from is something of a mystery on which we prefer not to speculate. It is not related to English stick despite the similarities between this word and Stück; coincidences do occur in language development. (For sure one of Mark Bailey's shticks is coming up with very Good Words like this one that he suggested for today.)
P.S. - Register for the Daily Good Word E-Mail! - You can get our daily Good Word sent directly to you via e-mail in either HTML or Text format. Go to our Registration Page to sign up today!


text:
Q: When did it become insulting to call someone crippled rather than handicapped or disabled?
A: Of the three words, "crippled" is by far the oldest, with roots going back to Anglo-Saxon times.
The adjective "crippled" has been in use since before 1300, and the noun "cripple" since about 950, according to the Oxford English Dictionary.
But another adjective, "lame," which we wrote about last year, is even older, dating back to around 725, though it's not heard much today in reference to people.
The OED doesn't say exactly when "cripple" and "crippled" were first considered insensitive and their use discouraged. And we can't tell from the published examples cited in the dictionary.
But it's safe to say that these words began to be replaced in the 20th century—first by "handicapped" and "person with a handicap," and later by "disabled" or "person with a disability."
Lately, even "disabled" and "disability" have been criticized by some as negative words that emphasize what people can't do, rather than what they can. So usage is still changing.
While we can't precisely pin down dates for these shifts in sense and sensibility, we can pin down a few etymologies.
"Cripple" has similar-sounding relatives in other Germanic languages, all of which have prehistoric roots in a word stem that's been reconstructed as krupilo-, from the verb kriupan (to "creep").
As the OED explains, the connection to "creep" may be explained "either in the sense of one who can only creep, or perhaps rather in that of one who is, in Scottish phrase, 'cruppen together,' i.e. contracted in body and limbs."
"Handicap" and "handicapped" were terms used in games and sports long before they were used to refer to disabilities.
They can be traced to "hand i' cap" (that is, "hand in cap"), an expression originating in the mid-17th century and referring to a game of chance in which forfeit money was put into a cap.
"Handicap" was first applied to horseracing in the mid-18th century. In the sporting sense, it means a disadvantage (extra weight, strokes, or some other condition) imposed on a superior competitor in favor of an inferior one to equalize chances.
"Hence," the OED says, in the 1890s a handicap came to mean "any encumbrance or disability that weighs upon effort and makes success more difficult."
But it didn't specifically mean a person's physical or mental disability until the early 20th century. The adjective "handicapped," the OED tells us, was first used this way in 1915.
"Disabled" has been around since the late 16th century in the general sense, defined by the OED as "rendered incapable of action or use; incapacitated; taken out of service."
While "disabled" has been used since the 17th century in reference to people's physical and mental capacities, it didn't replace "crippled" and "handicapped" until modern times. As the OED explains:
"The word disabled came to be used as the standard term in this sense in the second half of the 20th cent., and it remains the most generally accepted term in both British and North American English today. It superseded outmoded, and now frequently offensive, terms such as crippled, handicapped, etc."
We should mention, however, that not every disabled person considers the term "crippled" insensitive.
For example, Bill Veeck, the owner of several major league baseball teams from the mid-1940s to the early '80s, didn't.
Veeck, who was missing part of a leg, gave one of the chapters in his book Veeck as in Wreck this title: "I'm Not Handicapped, I'm Crippled."
Check out our books about the English language


text:
George Jones Thanks Fans Then Accuses Daughter Georgette Of Lying [Video]
George Jones has created a video to say thank you to his many loyal fans who have stuck by him over the years and in particular, those who have stood by him during his recent health issues. Jones has cancelled shows over the last couple of months as he battles an upper respiratory infection. As a result, he just cancelled the ramaining dates of his tour through may 20th, which has some speculating


text:
LEMONT, Ill. – Right when it looked as though Justin Rose might blow a big lead, he chipped in for birdie on the 17th hole to secure a two-shot victory Sunday in the BMW Championship that sends him to East Lake for a shot at US$10 million.
Rose closed with an even-par 71 in the rain at Cog Hill for his first win of the year, and it came at just the right time. He was not assured of making the FedEx Cup finale at the Tour Championship, and now is one of five players who only have to win at East Lake next week to collect golf's biggest bonus.
But it wasn't easy.
Five shots ahead with 10 holes to play, Rose's lead was down to one after he drove into the trees on the par-5 15th and made bogey. From just short of the 17th green, however, the 31-year-old from England holed a chip from 35 feet for an unlikely birdie that sent him on his way.
Senden shot 70, and his runner-up finish moved him from No. 55 in the FedEx Cup to No. 9, putting him among the top 30 from the 70 players at Cog Hill to advance to the Tour Championship.
Rose wasn't the only big winner at the third playoff event. Geoff Ogilvy, who had to birdie the last hole at the TPC Boston two weeks ago just to stay alive in the playoffs, shot a 69 and finished alone in third. Now he's in the Tour Championship, and qualified for the Presidents Cup at Royal Melbourne.
Indeed, there was more than one cup at stake on a dreary afternoon south of Chicago.
Rose captured the most important trophy — his third PGA Tour win, and the biggest of his career, that paid $1.44 million. The BMW Championship also was the final event for the top 10 players to qualify for the Presidents Cup.
Despite all the possibilities for the U.S. team, there was no change.
David Toms went from No. 10 to No. 8 with his tie for 10th. The heartache belonged to Bill Haas, who was tied for third at the BMW going into the final round. He was poised to claim one of the 10 spots until he posted a 42 on the back nine and shot 78, when a score of 75 would have been just enough.
"I knew if I played well, something good would happen," Haas said. "And I knew if I played bad, nothing would happen."
It's the second straight year that Haas walked away from Cog Hill feeling empty. A year ago, he finished 31st in the FedEx Cup by a mere seven points.
Hunter Mahan and Jim Furyk nailed down the last two spots for the United States. The other seven who had locked up spots were Matt Kuchar, Steve Stricker, Dustin Johnson, Phil Mickelson, Nick Watney, Webb Simpson and Bubba Watson.
Nothing but the order changed for the International team, either. Its list is based on the world ranking. Ogilvy, who was narrowly No. 10, moved ahead of Ryo Ishikawa to No. 9. The other eight players are Jason Day, Adam Scott, Charl Schwartzel, K.J. Choi, K.T. Kim, Retief Goosen, Ernie Els and Y.E. Yang.
Captains Fred Couples and Greg Norman will make two picks after the Tour Championship. Couples already has said Tiger Woods will be one of his picks.
For the FedEx Cup, Bo Van Pelt nailed down the 30th spot by a comfortable margin over Martin Laird. Even so, there were some tense moments. Despite difficult conditions, Camilo Villegas made nine birdies and had the best round of the day at 66. But he made bogey on the 18th hole, walked off the green to check a scoring terminal and slammed his fist onto the table.
Turns out it didn't matter.
The final round proved relatively flat, with only three players having a serious chance throughout the day. Rose was headed for a runaway when he birdied the sixth and seventh holes to reach 14 under, giving him a five-shot lead over Senden.
Back-to-back birdies for Senden around the turn, along with a bogey by Rose at the par-5 ninth, made it tight at the top. Rose did well to save par on the 13th and 14th holes.
Ogilvy, playing in the group ahead of Rose, ran off birdies on the 13th and 14th to get in the hunt. Ogilvy had good looks at birdie on three of the last four holes and failed to convert.
He made his goal of Royal Melbourne and East Lake. For a brief moment, he wanted more.
"It was a slightly flat feeling when you look back because I might have had a chance to win the tournament," Ogilvy said. "But who am I kidding? It's my best tournament in months."
Luke Donald, the world No. 1 who opened with a 75, closed with a 68 and finished alone in fourth. The top five players going to the Tour Championship are Webb Simpson, Johnson, Rose, Donald and Matt Kuchar. If any of them win at East Lake, they win the FedEx Cup.


text:
Atlanta, GA – Cesar Hernandez tallied four hits and two runs scored in the Philadelphia Phillies' 5-4 win over the Atlanta Braves in the third test of a four-game set.
Trailing 5-1 after eight innings of play, the Braves got within one after Justin Upton smacked a three-run homer in the ninth off Jonathan Papelbon. Freddie Freeman then singled and was put into scoring position when Evan Gattis walked, but Chris Johnson grounded out to shortstop to end the game.
With the loss, the Braves are one game behind the St. Louis Cardinals for the best record in the National League. Atlanta holds the head-to-head tiebreaker after winning the season series.
Papelbon surrendered four hits and a walk in the final frame.
Jimmy Rollins had two hits and a pair of runs scored for the Phillies, who snapped a three-game slide.
Ethan Martin allowed a run on four hits and a walk in a three-inning start for Philadelphia. Luis Garcia (1-1) picked up the win by tossing a scoreless fourth and fifth.
"Our young guys came out of the bullpen and did a great job," Phillies outfielder Domonic Brown said.
Mike Minor (13-9) fanned six, but yielded two runs on five hits and three walks over six frames for Atlanta, which had won four of its last six tilts coming in.
"I feel like I had pretty good stuff tonight. I was locating ok," Minor said.
Cameron Rupp's two-out, two-run single in the top of the first opened the scoring before Atlanta answered with a run in the home half on a Freeman sacrifice fly.
Both teams were held scoreless over the next five innings, before the Phillies added to their lead with two runs in the seventh and another in the eighth.
RBI singles by Brown and Rollins in the seventh and Chase Utley's bases- loaded single in the eighth upped the lead to 5-1.
Game Notes
The Phillies were 5-for-16 with runners in scoring position and banged out 13 hits ... Atlanta was 1-for-12 with runners in scoring position ... Upton's blast was his 27th of the year.


text:
Home | Reviews | Extras | Forums |
InuyashaSynopsisIn an attempt to steal the Shikon no Tama, the jewel of four souls, Inuyasha is shot by an arrow against a tree, putting him in a deep sleep for the next fifty years. The priestess sealing him, Kikyo, dies after the sealing and is buried with the jewel. Leaving the feudal era, a school girl named Kagome is taken through the well of souls by a centipede demon looking for the jewel. When taken to the feudal era, Kagome escapes and ends up at the tree where Inuyasha is sealed. Enemies at first, the two eventually forges a truce once the jewel is shattered, the pieces flying off in all directions, and the two have to track them all down. ReviewIt's actually kind of scary looking back at my time with Inuyasha. It's hardly the oldest show I've watched -- Galaxy Express 999 predates it with twenty years -- but it's still more than ten years since this show first aired. 13, to be more specific, and it wasn't THAT much later when I started watching it myself. Admittedly, starting off on the singles wasn't the brightest idea either, because Inuyasha requires some dedication from the viewers. Running in at 167 episodes, there's quite a lot of material to get through. I know the jewel of four souls shattered into quite a lot of pieces, but Inuyasha still found some time to throw in some filler here and there. Actually, make that a lot of filler. Which is going to be pretty ironic when you go read my review for Inuyasha: Final Act, a show that's finally available in the US (and to anyone else having access to region 1/A compatible DVD/Bluray players.) Those of you who read my original review (well, my second version -- the first one was a bit... overenthusiastic) might remember me mentioning being a bit of a Takahashi fan. Admittedly, this was partially due to the Ranma 1/2 manga being among the first manga I ever read, and it took my comedy bone with storm. I would later embellish this list with Mermaid Forest, but, true to be told, my list of watched stuff by Rumiko Takahashi is a bit... sparse. That said, if there's one thing I'm still standing behind, then that would be my opinion about this show. Granted, Inuyasha does settle into a "monster of the week" groove at times, but unlike many of its contemporaries, like Bleach or One Piece, Inuyasha is actually a love story first and a fightstravaganza second. Which brings us to the first niggle about Inuyasha: in many ways, it's more a rethread of Ranma 1/2 than a completely original show. Sure, it takes place in feudal Japan for the most part, but a lot of the characters are startingly similar, a fact that hasn't been lost on whoever chose voice actors, both in the original and in the dub. For instance, Inuyasha himself is basically Ranma with dog ears, and as such, both of them are voiced by Kappei Yamaguchi in Japanese and Richard Ian Cox in English. Curiously enough, Kikyo shares Akane Tendo's Japanese voice, while in English it's Kasumi's. (Go fig.) But even if they're not sharing voices, you can still see Ryoga Hibiki in wolf-demon love rival Koga, Ukyo Kuonji in Sango the demon hunter, and somewhat more strangely, Happosai in Myoga the flea. And Kagome? She's a significantly less violent Akane. Which is a plus, I guess. What makes Inuyasha compelling enough for a casual evening view, though, is simply its main plot, with various relatively non-complicated story revelations the show wisely portions out at carefully spread moments during the search for the jewels. Among those, the most important one is the love triangle when you eventually learn that the priestess who sealed Inuyasha to the tree at some point was in a budding relationship with him. However, due to a betrayal from an old wounded bandit who ended up making a deal with a bunch of demons, their trust in each other are shattered, which lead to the opening event in this very show. Also quickly introduced to the main story is Inuyasha's half brother Sesshoumaru, who at first is looking for his father's heirloom sword, the Tetsusaiga, originally left for his halfling son in the graveyard hidden somewhere. We learn some more about Inuyasha's family (later to be embellished on -- somewhat unofficially, mind -- in the third movie), most notably Inuyasha's mother, who was a human, and therefor not Sesshoumaru's favorite addition to the family. But the most common foil of a character in this show is probably Koga, the wolf demon. He kind of falls in love with Kagome (it's debatable, since his initial interest is mainly her ability to detect shikon shards), and quickly becomes the show's sole instigator of Inuyasha jealousy scenes. I would have been fine with this, though, except for one thing; his introduction is his tribe attacking a village and killing the inhabitants down to the last man, woman and child! You know... for food? And he has the nerve to show up for revenge when Inuyasha and the gang stop them by killing only the ones who refuse to run away. (Which, if memory serves me right, might have been a wolf or two. Tops.) And they call Sesshoumaru cold and murderous? The guy never killed anyone for no reason at all... or anyone who didn't attack him with the intent to kill. The guy who, let me remind you, rescued one of Koga's tribe's victims/early morning snacks and allowed her to travel with him and his goblinservant Jaken. Out of a morbid case of the interests, sure, but that still beats out "picking her out for an appetizer". One thing I really liked about Inuyasha is that the anime's art is a really nice transfer from the original manga. Even moving from TV series to movies to Final Act, Inuyasha's art is pretty consistent. Animation tend to vary quite much from season to season, but that's to be expected when a show crosses the 100 episode border and even starts looking longingly towards 200. The dub is also generally quite good. Richard Ian Cox does of course make for a good Inuyasha. He should -- after all, he's had more than enough practice by being Ranma. Moneca Stori impresses less as Kagome, though. However, she was new at this game at the time, and she improves considerably as the show goes along. More curiously, David Kaye, whom you might remember as the occasionally slightly hysterical Soun Tendo from Ranma 1/2, plays Sesshoumaru, Inuyasha's dark-voiced pretty-boy brother whom quickly made a fan of most, if not all, of the female viewers of this show. And the music? It's made by Kaoru Wada, who first impressed me with his score for 3x3 Eyes, and his work is actually more than up to scratch here. I just wish I had something positive to say about the opening and ending themes, all of which fits to Wada's wonderful score like a spike mat to the nuts. I'm not saying the songs are awful -- in fact, quite a few of them are very good -- but it just... doesn't mesh very well. And I will get into this in my review of Final Act, because... well... you'll see. All in all, I have to say that Inuyasha has aged remarkably well. The love triangle meshes greatly with the gem shard hunt, and new plot threads are introduced regularly without complicating the plot overly much. And, amazingly enough, the show isn't 90% battles and 10% preparing for the next set of battles. It's 80% battles, 10% talking about what they just did in said battle and 10% preparing for the next battle. ..... I kid, I kid. Still surprisingly enjoyable after all these years. Granted, I could have done without all the roundup talk, but nobody's perfect. — Stig Høgset Recommended Audience: Both people and monsters die in this show en masse. Most of them die without shedding as much as a drop of blood, though, and even the ones that are literally sliced in twain just dissolve in a shower of sparklies. Which is quite the departure from the manga, where many die quite messily. Version(s) Viewed: R1 DVD, bilingual. Review Status: Full (167/167) Inuyasha © 2001 Takahashi Rumiko / Shogakukan / Sunrise / YTV |
© 1996-2015 THEM Anime Reviews. All rights reserved. |


text:
Jenkintown Mayor Ed Foley, in a gut-busting campaign to draw attention to the tiny borough's varied restaurant scene, set out to visit all 24 of them on Saturday, starting with a pre-dawn visit to IHOP.
"With one pancake," Foley said in late afternoon. "And IHOP does not want to sell you one pancake."
The second-term Democrat said he's had to battle "mom guilt" from restaurant staff as he has eaten his way across Jenkintown, a town so small that he only needed to build in 15 minutes to walk from place to place.
"I really am having fun with it," he said shortly before his 16th stop of the day. "You feed on the energy of all these people who are excited to have you in their restaurant."
He said several restaurants have opened in Jenkintown in recent years - and more are poised to join them in the coming months - but he was surprised to count them and see 24 restaurants now populate a town of less than a single square mile. About 20 years ago, he said, Jenkintown had only one place to eat.
At some stops he was able to limit his intake: an egg and a piece of bacon at Joey Tate's, a single cupcake at Velvet Sky.
But when he hit La Pergola, his request for one latke produced three - along with a bowl of matzo ball soup.
And at Taste the Difference, a soul food takeout and catering place, they responded to his humble order of rice and beans with two ribs, collard greens and macaroni and cheese.
"I ate it all," said Foley, whose day job is in marketing for a Philadelphia insurance company.
Foley conceived the meal marathon, complete with photos on social media and a custom hashtag, as a way to promote Jenkintown's first restaurant week, which starts Tuesday. Several restaurants have set up shop in Jenkintown in recent years and a couple more are scheduled to open in the coming months.
What about all those calories? Foley didn't count them, figuring it wouldn't be very accurate anyhow.
"I did weigh myself before I started and I plan to weigh myself tonight," he told a reporter. "Just for science."


text:
This chapter provides conceptual descriptions of the basic elements of Oracle Internet Directory and discusses Oracle Internet Directory architecture.
This chapter contains these topics:
Section 3.2, "How Oracle Internet Directory Processes a Search Request"
Section 3.12, "The Service Registry and Service to Service Authentication"
Section 3.14, "Oracle Internet Directory and Identity Management"
Section 3.15, "Resource Information"
See Also:
"Related Documents" for suggestions on further reading about LDAP-compliant directories
This section contains these topics:
An Oracle Internet Directory node consists of one or more directory server instances connected to the same directory store. The directory store—that is, the repository of the directory data—is an Oracle Database.
All Oracle Internet Directory instances in the same domain connect to the same Oracle Database.
Figure 3-1 shows the various directory server elements and their relationships running on a single node.
Oracle Net Services is used for all connections between the Oracle database server and:
The Oracle directory server non-SSL port (3060 by default)
The Oracle directory server SSL-enabled port (3131 by default)
The OID Monitor
LDAP is used for connections between directory server and:
Oracle Directory Services Manager
Oracle directory replication server
The Oracle directory server instance and the Oracle directory replication server connect to OID Monitor by way of the operating system.
As shown in Figure 3-1, an Oracle Internet Directory node includes the following major elements:
Table 3-1 An Oracle Internet Directory Node
The Oracle directory replication server uses LDAP to communicate with an Oracle directory (LDAP) server instance. To communicate with the database, all components use OCI/Oracle Net Services. Oracle Directory Services Manager and the command-line tools communicate with the Oracle directory servers over LDAP.
Figure 3-2 illustrates an Oracle directory server instance, also called an LDAP server instance.
Figure 3-2 Oracle Directory Server Instance Architecture
One instance comprises one dispatcher process and one or more server processes. The Oracle Internet Directory dispatcher and server processes can use multiple threads to distribute the load. LDAP clients send LDAP requests to an Oracle Internet Directory listener/dispatcher process listening for LDAP commands at its port.
Oracle Internet Directory listener/dispatcher starts a configured number server process at startup time. The number of server processes is controlled by the orclserverprocs
attribute in the instance-specific configuration entry. The default value for orclserverprocs
is 1. Multiple server processes enable Oracle Internet Directory to take advantage of multiple processor systems.
The Oracle Internet Directory dispatcher process sends the LDAP connections to the Oracle Internet Directory server process in a round robin fashion. The maximum number of LDAP connections accepted by each server is 1024 by default. This number can be increased by changing the attribute orclmaxldapconns
in the instance-specific configuration entry, which has a DN of the form:
An Oracle Internet Directory component can be created by Oracle Identity Management 11g Installer or by a command-line tool. The program that creates Oracle Internet Directory follows specific steps in assigning the SSL and non-SSL port. First, it attempts to use 3060 as the non-SSL port. If that port is unavailable, it tries ports in the range 3061 to 3070, then 13060 to 13070.
Similarly, the program that creates Oracle Internet Directory attempts to use 3131 as its SSL port, then ports in the range 3132 to 3141, then 13131 to 13141.
Directory metadata is the information used by the directory server during run time for processing LDAP requests. It is stored in the underlying data repository. During startup, the directory server reads this information and stores it in a local metadata cache. It then uses this cache during its run time to process incoming LDAP operation requests.
The metadata cache is a write-through cache. An LDAP operation first writes to the database and then invalidates the corresponding cache entry. A subsequent search of that entry causes the cache to be refreshed.
The directory server has the following types of metadata in its local metadata cache:
The definitions of object classes, attributes, and matching rules supported by the directory server. The directory server uses this information during creation and modification of directory objects. A directory object is a collection of object classes and their associated attributes and matching rules. See Chapter 20, "Managing Directory Schema."
Access control policy point (ACP)
A directory administrative domain for defining and controlling access to the information in that domain. The directory server uses ACPs when determining whether to allow a certain LDAP operation performed by a user. See Chapter 29, "Managing Directory Access Control."
The root DSE (Directory Service Agent-Specific Entry) contains several attributes that store information about the directory server itself. For example, these attributes contain the following information items, to mention just a few:
Naming contexts DNs
Sub Schema Subentry DN
Superior references (referrals) DNs
Special entry DNs like Oracle Internet Directory configuration and registry containers
Special Entry DNs like change log and change status containers
DN of replications agreement container
Groups that can be used in access control policies.
The directory schema supports directory group objects through the standard groupofuniquenames
and groupofnames
object classes. These object classes hold information for such groups as distribution lists and mailing lists to mention just two.
Oracle Internet Directory extends these standard group objects through an auxiliary object class called orclprivilegegroup
. This object class, which supports privilege groups that can be used in access control policies, provides flexibility to grant or deny access to groups of users. The directory server uses this information during:
LDAP bind operations to find out the subscribed privileged groups for a given user
Access control policy evaluation if the policy has directives that grant or deny access to privileged groups
A special entry containing information about indexed attributes in the underlying database. The directory uses this information during directory search operations. See "About Indexing Attributes".
A special entry containing information about hosted companies. A hosted company is an enterprise to which another enterprise provides services. The metadata in this entry includes the hosted company DN, user search base, nickname and other attributes, all of which are described in Chapter 33, "Planning, Deploying and Managing Realms".
A special entry containing information about the kind of operation that triggers a plug-in event, and the point in the operation when that plug-in is to be triggered. Chapter 44, "Developing Plug-ins for the Oracle Internet Directory Server," describes this information.
A special entry containing information about the encryption and verifier attribute types. Chapter 30, "Managing Password Verifiers," describes this information.
One or more special entries containing information about policies enforced by the directory server for the user password credentials. The directory server uses this information during run time to enforce the password policies. See Chapter 28, "Managing Password Policies".
This example shows you how Oracle Internet Directory processes a search request.
The user or client enters a search request that is conditioned by one or more of the following options:
SSL: The client and server can establish a session that uses SSL encryption and authentication, or SSL encryption only. If SSL is not used, the client's message is sent in clear text.
Type of user: The user can seek access to the directory either as a particular user or as an anonymous user, depending on which of the two has the necessary privileges to perform the desired function.
Filters: The user can narrow the search by using one or more search filters, including those that use the Boolean conditions "and," "or," and "not," and those that use other operators such as "greater than, "equal to," and "less than."
The C API, using the LDAP protocol, sends a request to a directory server instance to connect to the directory.
The directory server authenticates the user, a process called binding. The directory server also checks the Access Control Lists (ACLs) to verify that the user is authorized to perform the requested search.
The directory server converts the search request from LDAP to Oracle Call Interface (OCI)/Oracle Net Services and sends it to the Oracle Database.
The Oracle Database retrieves the information and passes it back through the chain—to the directory server, then to the C API, and, finally, to the client.
The maximum number of attributes you can specify in a search filter is 255.
In an online directory, each collection of information about an object is called an entry. An entry can include, for example, information about an employee, a conference room, an e-commerce partner, or a shared network resource such as a printer.
This section contains these topics:
Each entry in an online directory is uniquely identified by a distinguished name (DN). The distinguished name tells you exactly where the entry resides in the directory hierarchy. This hierarchy is represented by a directory information tree (DIT).
To understand the relation between a distinguished name and a directory information tree, look at Figure 3-3.
The DIT in Figure 3-3 includes entries for two employees of Acme Corporation who are both named Anne Smith. It is structured along geographical and organizational lines. The Anne Smith contained in the left branch works in the Sales division in the United States, while the other works in the Server Development division in the United Kingdom.
The Anne Smith contained in the right branch has the common name (cn
) Anne Smith. She works in an organizational unit (ou
) named Server Development, in the country (c
) of United Kingdom of Great Britain and Northern Ireland (uk
), in the organization (o
) Acme.
The DN for this "Anne Smith" entry is:
cn=Anne Smith,ou=Server Development,c=uk,o=acme
Note that the conventional format of a distinguished name places the lowest DIT component at the left, then follows it with the next highest component, moving progressively up to the root.
Within a distinguished name, the lowest component is called the relative distinguished name (RDN). For example, in the previous entry for Anne Smith, the RDN is cn=Anne Smith
. Similarly, the RDN for the entry immediately above Anne Smith's RDN is ou=Server Development
, the RDN for the entry immediately above ou=Server Development
is c=uk
, and so on. A DN is thus a concatenation of RDNs that reflects parent-child relationships in the DIT. Within the DN, RDNs are separated by commas.
To locate a particular entry within the overall DIT, a client uniquely identifies that entry by using the full DN—not simply the RDN—of that entry. For example, within the global organization in Figure 3-3, to avoid confusion between the two Anne Smiths, you would use each one's full DN. If there are potentially two employees with the same name in the same organizational unit, you could use additional mechanisms—for example, you could identify each employee with a unique number.
To make operations on entries quick and efficient, Oracle Internet Directory uses entry caching. When you enable this feature, Oracle Internet Directory assigns a unique identifier to each entry, then stores a specified number of those identifiers in cache memory. When a user performs an operation on an entry, the directory server looks in the cache for the entry identifier, then retrieves the corresponding entry from the directory. This method enhances Oracle Internet Directory performance, and is especially useful in smaller and medium-sized enterprises.
Beginning with Release 11gR1 (22.214.171.124), the entry cache resides in shared memory, so multiple Oracle Internet Directory server instances on the same host can share the same cache. Attributes for confuring the cache now reside in the DSA configuration entry.
The entry cache is a write-through cache. An LDAP operation first writes to the database and then invalidates the corresponding cache entry. A subsequent search of that entry causes the cache to be refreshed.
See Also:
The Server Entry Cache section of the Oracle Internet Directory chapter in Oracle Fusion Middleware Performance and Tuning Guide.
In a typical telephone directory, an entry for a person contains such information items as an address and a phone number. In an online directory, such an information item is called an attribute. Attributes in a typical employee entry can include, for example, a job title, an e-mail address, or a phone number.
For example, in Figure 3-4, the entry for Anne Smith in Great Britain (uk) has several attributes, each providing specific information about her. These are listed in the balloon to the right of the tree, and they include emailaddrs
, printername
, jpegPhoto
, and app preferences
. Moreover, each bullet in Figure 3-4 is also an entry with attributes, although the attributes for each are not shown.
Figure 3-4 Attributes of the Entry for Anne Smith
Each attribute consists of an attribute type and one or more attribute values. The attribute type is the kind of information that the attribute contains—for example, jobTitle
. The attribute value is the particular occurrence of information appearing in that entry. For example, the value for the jobTitle
attribute could be manager
This section contains these topics:
Attributes contain two kinds of information.
Application Attributes
This information is maintained and retrieved by directory clients and is unimportant to the operation of the directory. A telephone number, for example, is application information.
System Configuration Attributes
This information pertains to the operation of the directory itself. Some operational information is specified by the directory to control the server—for example, the time stamp for the creation or modification of an entry, or the name of the user who creates or modifies an entry. Other operational information, such as access information, is defined by administrators and is used by the directory program in its processing.
See Also:
Chapter 9, "Managing System Configuration Attributes" for more information about system configuration attributes.
To enhance your ability to search for entries, Oracle Internet Directory automatically creates several system configuration attributes when you add an entry to the directory. These include:
Table 3-2 Attributes Created with Each New Entry
Attribute | Description |
Name of the person creating the entry |
Time of entry creation in UTC (Coordinated Universal Time) |
Name of person modifying the entry |
Time of last entry modification in UTC |
Moreover, when a user modifies an entry, Oracle Internet Directory automatically updates the modifiersName
and modifyTimestamp
attributes to, respectively, the name of the person modifying the entry, and the time of the entry modification in UTC.
See Also:
Chapter 9, "Managing System Configuration Attributes" for instructions on configuring system configuration attributes.
Attributes can be either single-valued or multivalued. Single-valued attributes carry only one value in the attribute, whereas multivalued attributes can have several. An example of a multivalued attribute is a group membership list with names of everyone in the group.
Oracle Internet Directory implements all of the standard LDAP attributes. Some of the more common ones defined by RFC 2798 of the Internet Engineering Task Force (IETF) are shown in Table 3-3.
Table 3-3 Common LDAP Attributes
Attribute Type | Attribute String | Description |
Common name of an entry—for example, |
domainComponent |
The DN of the component in a Domain Name System (DNS)—for example, |
Photographic image in JPEG format. This is stored in binary format. |
Name of an organization—for example, |
Name of a unit within an organization—for example, |
owner |
Distinguished name of the person who owns the entry, for example, |
surname, sn |
Last name of a person—for example, |
telephoneNumber |
Telephone number—for example, |
See Also:
"Oracle Identity Management LDAP Attribute Reference" in Oracle Fusion Middleware Reference for Oracle Identity Management for a list of several attributes Oracle Internet Directory provides.
Attribute syntax is the format of the data that can be loaded into each attribute. For example, the syntax of the telephoneNumber
attribute might require a telephone number to be a string of numbers containing spaces and hyphens. However, the syntax for another attribute might require specifying whether the data has to be in the form of a date, or whether the data can consist of numbers only. Each attribute must have one and only one syntax.
Oracle Internet Directory recognizes most of the syntaxes specified in RFC 2252 of the Internet Engineering Task Force (IETF), allowing you to associate most of the syntaxes described in that document with an attribute. In addition to recognizing the syntaxes in RFC 2252, Oracle Internet Directory also enforces some LDAP syntaxes. You cannot add new syntaxes beyond those already supported by Oracle Internet Directory.
See Also:
"About LDAP Attribute Syntax" in Oracle Fusion Middleware Reference for Oracle Identity Management.
In response to most incoming client requests, the directory server performs search and compare operations. During these operations, the directory server consults the relevant matching rule to determine equality between the attribute value sought and the attribute value stored. For example, matching rules associated with the telephoneNumber
attribute could cause "(650) 123-4567" to be matched with either "(650) 123-4567" or "6501234567" or both. When you create an attribute, you associate a matching rule with it.
Oracle Internet Directory implements all the standard LDAP matching rules. You cannot add new matching rules beyond those already supported by Oracle Internet Directory.
See Also:
Chapter 20, "Managing Directory Schema" for information on viewing matching rules.
"About LDAP Matching Rules" in Oracle Fusion Middleware Reference for Oracle Identity Management.
An attribute type can have various options that enable you to specify how the value for that attribute is made available in a search or a compare operation. For example, suppose that an employee has two addresses, one in London, the other in New York. Options for that employee's address
attribute could allow you to store both addresses.
Moreover, attribute options can include language codes. For example, options for John Doe's givenName
attribute could enable you to store his given name in both French and Japanese.
For clarity, we can distinguish between an attribute with an option and its base attribute, which is the same attribute without an option. For example, in the case of givenName;lang-fr=Jean
, the base attribute is givenName
; the French value for that base attribute is givenName;lang-fr=Jean
An attribute with one or more options inherits the properties—for example, matching rules and syntax— of its base attribute. To continue the previous example, the attribute with the option cn;lang-fr=Jean
inherits the properties of cn
You cannot use an attribute option within a DN. For example, the following DN is incorrect: cn;lang-fr=Jean, ou=sales,o=acme,c=uk
An object class is a group of attributes that define the structure of an entry. When you define a directory entry, you assign one or more object classes to it. Some of the attributes in these object classes are mandatory and must have values, others are optional and can be empty.
For example, the organizationalPerson
object class includes the mandatory attributes commonName
) and surname
), and the optional attributes telephoneNumber
, uid
, streetAddress
, and userPassword
. When you define an entry by using the organizationalPerson
object class, you must specify values for commonName
) and surname
). You do not need to provide values for telephoneNumber
, uid
, streetAddress
, and userPassword
This section contains these topics:
A subclass is an object class derived from another object class. The object class from which a subclass is derived is called its superclass. For example, the object class organizationalPerson
is a subclass of the object class person
. Conversely, the object class person
is the superclass of the object class organizationalPerson
Subclasses inherit all of the attributes belonging to their superclasses. For example, the subclass organizationalPerson
inherits the attributes of its superclass, person
. Entries also inherit attributes that their superclasses have inherited.
In itself, an object class contains no values. Only an instance of an object class—that is, an entry—contains values. When a subclass inherits attributes from a superclass, it inherits only the attribute definitions of the superclass.
One special object class, called top
, has no superclasses. It is one of the superclasses of every object class in the directory, and its attribute definitions are inherited by every entry.
There are three types of object classes:
Structural object classes describe the basic aspects of an object. Most of the object classes that you use are structural object classes, and every entry should belong to at least one structural object class. Examples of structural object classes are person
and groupOfNames
These object classes model real-world entities and their physical or logical attributes. Examples include people, printers, and database connections.
Structural object classes use structure rules to place restrictions on the kinds of objects you can create under any given object class. For example, a structure rule might require all objects below the organization
) object class to be organizational units
). Following this rule, you could not enter person
objects directly below an organization
object class. Similarly, a structure rule might disallow you from placing an organizational unit (ou
) object below a person
Auxiliary object classes are groupings of optional attributes that expand the existing list of attributes in an entry. Unlike structural object classes, they do not place restrictions on where an entry may be stored, and you can attach them to any entry regardless of that entry's location in the DIT.
An abstract object class is a virtual object class. It is used only for convenience when specifying the highest levels of the object class hierarchy. It cannot be the only object class for an entry. For example, the object class top
is an abstract object class. It is required as a superclass for all structural object classes, but it cannot be used alone.
The top
object class includes the mandatory attribute objectClass
and several optional attributes. The optional attributes in top
: Global identification which remains constant if the entry is moved
: Name of the last person to modify the object class
: Time when the object class was last modified
: access control list (ACL) directives that apply to all entries in the subtree below the access control policy point (ACP) where this attribute is defined
: Access control policy pertaining to only a specific entity, for example, a special user
See Also:
Section 3.8, "Globalization Support" for more information on access control policies and ACLs
Section 20.1.3, "Understanding Attributes" for a discussion of how to add additional content to entries
A directory naming context is a subtree that resides entirely on one server. It must be a complete subtree, that is, it must begin at an entry that serves as the top of the subtree, and extend downward to either leaf entries or references to subordinate naming contexts. It can range in size from a single entry to the entire directory information tree (DIT).
Figure 3-5 illustrates correct and incorrect naming contexts. Notice that the correct ones on the left are contiguous, and the incorrect ones on the right are not.
Figure 3-5 Correct and Incorrect Naming Contexts
To enable users to discover specific naming contexts, you can publish those naming contexts in Oracle Internet Directory by using ldapmodify.
See Also:
Chapter 11, "Managing Naming Contexts" for instructions on how to publish a naming context
Oracle Internet Directory is a key element of Oracle Identity Management. You can deploy multiple Oracle components to work against a shared instance of Oracle Internet Directory. This sharing allows an enterprise to simplify security management across all applications.
In addition to the role it plays in the Oracle Identity Management infrastructure, Oracle Internet Directory provides many powerful features for protecting information.
Security features within Oracle Internet Directory itself include:
The Secure Sockets layer: Ensuring that data is not modified, deleted, or replayed during transmission
Data privacy: Ensuring that data is not inappropriately observed while it is stored in Oracle Internet Directory
Password policies: Establishing and enforcing rules for how passwords are defined and used
Authorization: Ensuring that a user reads or updates only the information for which that user has privileges
Password protection: Ensuring that passwords are not easily discovered by others
Authentication: Ensuring that the identities of users, hosts, and clients are correctly validated
You can use all these features to enforce a uniform security policy for multiple applications enabled for Oracle Internet Directory, and do so in either an enterprise or hosted environment. You do this by deploying the directory for administrative delegation. This deployment allows, for example, a global administrator to delegate to department administrators access to the metadata of applications in their departments. These department administrators can then control access to their department applications.
You can also use security features of the underlying Oracle Database, such as Transparent Data Encryption and Database Vault, to protect Oracle Internet Directory data.
Oracle Internet Directory follows LDAP Version 3 internationalization (I18N) standards. These standards require that the database storing directory data use Unicode Transformation Format 8-bit (UTF-8) character set. With Oracle9i, Oracle added a new UTF-8 character set called AL32UTF8. This database character set supports the latest version of Unicode (3.2), including the latest supplementary characters. This allows Oracle Internet Directory to store the character data of almost any language supported by Oracle Globalization Support. Moreover, although several different application program interfaces are involved in the Oracle Internet Directory implementation, Oracle Internet Directory ensures that the correct character encoding is used with each API.
Globalization Support means support for both single-byte and multibyte characters. A single-byte character is represented by one byte of memory. ASCII text, for example, uses single-byte characters. By contrast, a multibyte character can be represented by more than one byte. Simplified Chinese, for example, uses multibyte characters. An ASCII representation of a simplified Chinese directory entry definition might look like this:
dn: o=\274\327\271\307\316\304,c=\303\300\271\372 objectclass: top objectclass: organization o: \274\327\271\307\316\304
Where the attribute values correspond to an ASCII representation of a simplified Chinese directory entry definition.
By default, the main Oracle Internet Directory components—OID Monitor (OIDMON), OID Control Utility (OIDCTL), Oracle directory server (OIDLDAPD), and Oracle directory replication server (OIDREPLD)—accept only the UTF-8 character set. The Oracle character set name is AL32UTF8.
The Oracle directory server and database tools are no longer restricted to run on a UTF8 database. However, you must ensure that all characters in the client character set are included in the database character set (with same or different character codes) if the database underlying the Oracle Internet Directory server is not AL32UTF8 or UTF8. Otherwise, there may be data loss during LDAP add, delete, modify, or modifydn operations if the client data cannot be mapped to the database character set.
Oracle Directory Services Manager uses Unicode (UTF-16—that is, fixed-width 16-bit Unicode). It can support internationalized character sets.
See Also:
Oracle Database Globalization Support Guide in the Oracle Database Documentation Library for a detailed discussion of Globalization Support.
Although an online directory is logically centralized, it can be physically distributed onto several servers. This distribution reduces the work a single server would otherwise have to do, and enables the directory to accommodate a larger number of entries.
A distributed directory can be either replicated or partitioned. When information is replicated, the same naming contexts are stored by more than one server. When information is partitioned, one or more unique, non-overlapping naming contexts are stored on each directory server. In a distributed directory, some information may be partitioned and some may be replicated.
This section contains these topics:
Replication is the process of copying and maintaining the same naming contexts on multiple directory servers. See Chapter 6, "Understanding Oracle Internet Directory Replication" for a discussion of replication concepts.
Partitioning, in which each directory server stores one or more unique, non-overlapping naming contexts, is another way of distributing directory information.
Figure 3-6 shows a partitioned directory in which some naming contexts reside on different servers.
In Figure 3-6, four naming contexts reside on Server A:
Two naming contexts on Server A are replicated on Server B:
The directory uses one or more knowledge references to locate information that is requested of Server B, but that resides on Server A. It passes this information to a client in the form of a referral.
A knowledge reference provides the names and addresses of the various naming contexts held in another partition. For example, in Figure 3-6, Server B uses knowledge references to point to the c=us
and c=uk
naming contexts on Server A. When Server B is asked for information residing on Server A, it sends back one or more referrals to Server A. Clients can then use these referrals to contact Server A.
Typically, each directory server contains both superior and subordinate knowledge references. Superior knowledge references point upward in the DIT toward the root. They tie the partitioned naming context to its parent. Subordinate knowledge references point downward in the DIT to other partitions.
For example, in Figure 3-7, Server B holds four naming contexts, two of which are superior to the others. These two superior naming contexts use subordinate knowledge references to point to their subordinate naming contexts. Conversely, the naming context on Server A has an immediate superior residing on Server B. Server A therefore uses a superior knowledge reference to point to its parent on Server B.
Naming contexts that start at the top of the DIT obviously cannot have a knowledge reference to a superior naming context.
There are presently no Internet standards for enforcing the validity of knowledge references, and Oracle Internet Directory does not do so. It is up to the administrator to ensure consistency among knowledge references within an enterprise network.
Oracle recommends that permission for managing knowledge reference entries be restricted, as is the case with any other privileged administrative function such as schema or access control.
There are two kinds of referrals:
Smart referrals
These are returned to the client when the knowledge reference entry is in the scope of the search. It points the client to the server that stores the requested information.
For example, suppose that:
Server A holds the naming context, ou=server development,c=us,o=acme
, and has a knowledge reference to Server B.
Server B holds the naming context ou=sales,c=us,o=acme
When a client sends a request to Server A for information in ou=sales,c=us,o=acme
, Server A provides the user with a referral to Server B.
Default referrals
These are returned when the base object is not in the directory, and the operation is performed in a naming context on another server. A default referral typically sends the client to a server that has more detailed information about the directory partitioning arrangement.
For example, suppose that Server A holds:
The naming context c=us,o=acme
A knowledge reference to Server PQR that has more knowledge about the overall directory partitioning arrangement
Now suppose that a client requests information on c=uk,o=acme
. When Server A finds that it does not have the c=uk,o=acme
naming context, it provides the client with a referral to Server PQR. From there, the client can find the server holding the requested naming context.
Oracle Delegated Administration Services is a set of pre-defined, Web-based units for performing directory operations on behalf of a user. This set of services frees directory administrators from the routine tasks of directory management by enabling them to delegate specific functions to other administrators and to end users. It provides most of the functionality that directory-enabled applications require, such as creating a user entry, creating a group entry, searching for entries, changing user passwords, and other employee-specific data.
All references to Oracle Delegated Administration Services in this chapter refer to Oracle Delegated Administration Services 10g (10.1.4.3.0) or later.
You can use Oracle Delegated Administration Services to develop your own tools for administering application data in the directory. Or you can use the Oracle Internet Directory Self-Service Console, a tool based on Oracle Delegated Administration Services that comes ready-to-use with Oracle Internet Directory. This console is used by several Oracle components to provide delegated administration.
See Also:
Oracle Identity Management Guide to Delegated Administration in the 10g (10.1.4.0.1) library.
The Service Registry and the Service to Service Authentication framework are Oracle Internet Directory features that facilitate integration between Oracle technology components that request services from one another. The Service Registry provides a place to store information, so that the components can discover each other. The Service to Service Authentication framework allows one component to authenticate to another and establishes trust among them.
The Service Registry is a container in Oracle Internet Directory (under cn=Services, Cn=OracleContext) where components store connectivity information, such as protocol, and other information, such as type of service. During installation, each OCS component registers its information in the Registry. At run-time the components discover information registered by other components. Service Registry objects are stored in the Oracle Internet Directory DIT in a component-specific Services container in the rootOracleContext.
Service to Service Authentication is a framework that allows one service to authenticate to another and establish trusts among the services. At install time, each of the client services is provisioned with a username and password in Oracle Internet Directory. In addition, each target service defines an authorization role in Oracle Internet Directory to control which components should it trust. When a component requests services of another component, the requestor must authenticate to the target service like any other client, using its own identity and credentials. The requesting service must also be listed in the Target services Trusted Application group (Default Group: contrasted Applications, counterpoise, cn=OracleContext). The requesting service also must send the user's identity so that the target service can authenticate the user as well. The data is sent securely, using either Digest authentication or the target service's native secure authentication.
Oracle Directory Integration Platform enables an enterprise to integrate its applications and other directories with Oracle Internet Directory. It provides all the interfaces and infrastructure necessary to keep the data in Oracle Internet Directory consistent with that in enterprise applications and connected directories. It also makes it easier for third-party vendors and developers to develop and deploy their own connectivity agents.
For example, an enterprise might want employee records in its HR database to be synchronized with Oracle Internet Directory. In addition, the enterprise may deploy certain LDAP-enabled applications (such as Oracle Portal) that must be notified whenever changes are applied to Oracle Internet Directory.
Based on the nature of integration, Oracle Directory Integration Platform provides two distinct services:
The synchronization integration service, which keeps connected directories consistent with the central Oracle Internet Directory
The provisioning integration service, which sends notifications to target applications to reflect changes made to a entries of interest, such as users and groups
This section contains these topics:
Identity management usually refers to the management of an organization's application users. Steps in their security life cycle include account creation, suspension, privilege modification, and account deletion. The managed entities may also include devices, processes, applications, or anything else that must interact in a networked environment. They may also include users outside of the organization, for example customers, trading partners, or Web services.
Identity management is important to IT deployments because it can reduce administrative costs while at the same time improving security.
The Oracle Identity Management products enable deployments to manage centrally and securely all enterprise identities and their access to various applications in the enterprise. Identity management comprises these tasks:
Creating enterprise identities and managing shared properties of these identities through a single enterprise-wide console
Creating groups of enterprise identities
Provisioning these identities in various services available in the enterprise. This includes:
Account creation
Account suspension
Account deletion
Managing policies associated with these identities. These include:
Authorization policies
Authentication Policies
Privileges delegated to existing identities
The Oracle Identity Management products include the following:
Oracle Internet Directory, a scalable, robust LDAP Version 3-compliant directory service implemented on the Oracle Database.
Oracle Virtual Directory, which provides access to multiple data sources without the need to synchronize or move data from its native location. Oracle Virtual Directory can provide multiple application-specific views of identity data and can also be used to secure data access to the application-specific sources and enhance high-availability to existing data-sources.
Oracle Directory Integration Platform, which permits synchronization between Oracle Internet Directory and other directories and user repositories.
Oracle Delegated Administration Services, which provides trusted proxy-based administration of directory information by users and application administrators. (Oracle Internet Directory 11g Release 1 is compatible with Oracle Single Sign-On 10g (10.1.4.3.0) or later.)
Oracle Single Sign-On, which provides single sign-on access to Oracle and third party web applications. (Oracle Internet Directory 11g Release 1 is compatible with Oracle Delegated Administration Services 10g (10.1.4.3.0) or later.)
Oracle Identity Federation, which provides a self-contained federation solution that combines the ease of use and portability of a standalone application with a scalable, standards-based proven interoperable architecture.
Oracle Identity Manager is a provisioning system for automatically granting and revoking access to enterprise applications and managed systems.
Oracle Role Manager is an enterprise-class application for managing business and organizational relationships, roles, and entitlements.
Oracle Enterprise Single Sign-On is an access management system for delivering enterprise authentication and single sign-on for mainframe, client/server and Web applications
Oracle Access Manager is a management system for configuring digital identities and controlling access to protected applications and content in heterogeneous environments, primarily on the Web.
Oracle Adaptive Access Manager is the solution for web access real-time fraud detection and multi-factor online authentication security for the enterprise.
Oracle Entitlements Server, which enables application developers to externalize and centralize fine-grained authorization policies that would previously have been embedded within applications.
Oracle Authentication Services for Operating Systems, which enables you to centralize storage, authentication, and management of user identities on Linux and UNIX systems using Oracle Internet Directory.
While Oracle Identity Management is designed to provide an enterprise infrastructure for Oracle products, it can also serve as a general-purpose identity management solution for user-written and third-party enterprise applications. It provides a robust and scalable enterprise-wide identity management platform for third-party applications, hardware, and network operating systems. Custom applications can leverage Oracle Identity Management through a set of documented and supported services and APIs, for example:
Oracle Internet Directory provides LDAP APIs for C, Java, and PL/SQL, and is compatible with other LDAP SDKs.
Oracle Delegated Administration Services provide a core self-service console that may be customized to support third-party applications. In addition, it provides several services for building customized administration interfaces that manipulate directory data.
The Oracle Directory Synchronization Service facilitates the development and deployment of custom solutions for synchronizing Oracle Internet Directory with third-party directories and other user repositories.
The Oracle Directory Integration Platform enables you to provision third-party applications and integrate the Oracle environment with other provisioning systems.
Oracle Single Sign-On provides APIs for developing and deploying partner applications that share a single sign-on session with other Oracle Web applications.
In addition, Oracle works with third-party application vendors to ensure that their applications can leverage Oracle Identity Management out of the box.
An identity management realm defines an enterprise scope over which certain identity management policies are defined and enforced by the deployment. It comprises:
A well-scoped collection of enterprise identities—for example, all employees in the US domain.
A collection of identity management policies associated with these identities. An example of an identity management policy would be to require that all user passwords have at least one alphanumeric character.
A collection of groups—that is, aggregations of identities—that simplifies the setting of the identity management policies.
You can define multiple identity management realms within the same Oracle Identity Management infrastructure. Multiple realms enable you to isolate user populations and enforce a different identity management policy—for example, password policy, naming policy, self-modification policy—in each realm.
Each identity management realm is uniquely named to distinguish it from other realms. It also has a realm-specific administrator with complete administrative control over the realm.
For all Oracle components to function, an identity management realm is required. One particular realm, created during installation of Oracle Internet Directory, is called the default identity management realm. It is where Oracle components expect to find users, groups, and associated policies whenever the name of a realm is not specified.
There can be only one default identity management realm in the directory. If a deployment requires multiple identity management realms, then one of them must be chosen as the default.
The Oracle Identity Management infrastructure supports a flexible set of management policies which comprise:
Directory structure and naming policies that enable you to:
Customize the directory structure in Oracle Internet Directory for your deployment.
Specify where various identities are to be located and how they are uniquely identified.
Authentication policies that enable you to specify authentication methods and protocols supported by the Oracle Identity Management infrastructure
Identity management authorizations that enable you to control access to certain privileged services and delegate administration wherever necessary
In Oracle Internet Directory Release 9.0.2, the equivalent term for "identity management realm" was "subscriber."
To fulfill the requests of users, some Oracle components gather data from various repositories and services. To gather the data, these components require the following information:
Information specifying the type of resource from which the data is to be gathered. The type of resource could be, for example, an Oracle Database. This is called resource type information.
Information for connecting and authenticating users to the resources. This is called resource access information.
This section contains these topics:
Information about the resources that an application uses to service a user request is called resource type information. A resource type can be, for example, an Oracle Database or a Java Database Connectivity Pluggable Data Source. Resource type information includes such items as the class used to authenticate a user, the user identifier, and the password.
You specify resource type information by using the Oracle Internet Directory Self-Service Console.
Information for connecting and authenticating users to the databases is called resource access information. It is stored in an entry called a resource access descriptor (RAD) from which it can be retrieved and shared by various Oracle components.
For example, to service the request of a user for a sales report, Oracle Reports queries multiple databases. When it does this, it does the following:
Retrieves the necessary connect information from the RAD
Uses that information to connect to those databases and to authenticate the user requesting the data
After it has done this, it compiles the report.
You specify resource access information by using the Oracle Internet Directory Self-Service Console. You can specify resource access information for each individual user or commonly for all users. In the latter case, all users connecting to a given application use, by default, the same information to connect to the necessary databases. Oracle recommends defining default resource access information whenever an application has its own integrated account management—for example, where each user is defined within the application itself with a unique single sign-on user name.
Figure 3-8 shows where resource information is located in the DIT.
As Figure 3-8 shows, the resource access and resource type information is stored in the Oracle Context.
Resource access information for each user is stored in the cn=User Extensions
node in the Oracle Context. In this example, the cn=User Extensions
node contains resource access information for both the default user and for specific users. In the latter cases, the resource access information includes that needed for accessing both the Sales and the Bug databases.
Resource access information for each application is stored in the object identified by the application name—in this example, cn=Oracle Reports Services, cn=Products,cn=Oracle Context,dc=us,dc=acme,dc=com
. This is the user information specific to that product.
Resource type information is stored in the container cn=resource types, cn=common,cn=products,cn=Oracle Context
See Also:
The sections about managing your own resource information, creating user entries, configuring default resources, and creating new resource types in Oracle Identity Management Guide to Delegated Administration in the 10g (10.1.4.0.1) library for instructions for an end user to specify resource access information
"Plug-in Schema Elements" in Oracle Fusion Middleware Reference for Oracle Identity Management
Oracle Fusion Middleware Publishing Reports to the Web with Oracle Reports Services


text:
We make our textured 4x6 mistletoe and holly scented candles using a process that causes them to have a rough, stone like finish when they harden. These rustic candles have a beautiful contrast with the smooth straight edges in a modern home. Surrounding them with botanical accents will create an organic, natural look. Our strong fragrances will freshen the air and the flickering candle light will create a relaxing ambiance. Burn the candle long enough for the liquid pool to to almost reach the edge then extinguish the flame. Allow the wax to cool before relighting it again. Doing this will maximize the length of time your candle will burn and allow it to use up nearly all the wax.
What It Smells Like
A sensual Christmas Fragrance that will help you get a kiss under the mistletoe. It blends a miraculous combination of cedar leaf, English holly, trailing ivy, sandalwood, Indian vetiver, and frosted musk. A holiday favorite, more dry than sweet or fruity, for those who crave a more pure essence.Product Specs:
- Burn Time: 70 to 90 hours
- Scent: strong scented using blends of synthetic and essential oils.
- Wicks: 100 percent lead free braided cotton
- Size: 4 in. diameterx6.25 in. tall
- Wax Type: paraffin


text:
Skip to Main Content
About Us
Around Town
Doing Business
Public Works Department
Public Projects
Larkspur's CIP Projects
Completed CIP Projects
Piper Park Improvement Project (FY16-17)
Piper Park
Mission Accomplished
The Piper Park Playground project is complete and open for business.
Almost any time of day, children of all sizes can be seen climbing, jumping, swinging, spinning, laughing and having a good time! By design, some of the equipment is more challenging so kids can experiment on "scarier" pieces and feel the thrill of accomplishment when they finally reach their individual goals.
Certain equipment choices were selected with children of differing abilities in mind to allow them to be in the middle of the fun instead of a passive observer. The large spinning cone (called the Apollo) is one such item that allows less able-bodied or younger children to sit inside the net while it is spinning. Caretakers of all ages are also enjoying the piece, sometimes being the "spinner" and other times being "spun."
If you haven't done so yet, please stop by the playground and join in the fun!
Your Tax Dollars at Work
This project was made possible by funding from County of Marin Measure A Funds and City of Larkspur Park Development Fees.
Into High Gear - December 19, 2017
The installation is now in full gear. There are parts and pieces all over the place, but rest assured that it is starting to come together!
A shout-out to the great crew members who are working in cold and wet conditions to get this project completed! If you're passing by the playground, please give them a "thumbs up" for a job well done.
Exciting Delivery - December 12, 2017
An intriguing piece of equipment was delivered to Piper Park on Monday morning. Our apologies to the Larkspur Walkers for the inconvenient timing of the big rig arriving just as the Walkers were getting into their cars to leave. City staff did a great job of traffic control and no walkers or tree stumps were bruised in the process!
Rain Delays
The heavy rains have made the playground into a mud pit!
The installation crew has been delayed by rain days, needing to pump out water before they can start work and slow movement in muddy conditions. They are working as fast as they can, but the project is about a week or two behind schedule.
Main Post Go In - December 7, 2017
The posts for the two new play structures go into the ground. The fun is starting!
Down to Bare Dirt - December 2, 2017
The existing playground surfacing has been removed and all ready to start laying out where the new play structures are going in. The crew will work on putting in new ADA pathways and ramps.
Construction Begins - November 21, 2017
The safety fencing up and the old equipment has been pulled down!
The wait is almost over! The renovation of Piper Park playground is scheduled to start on Monday, November 21st. Some very exciting and dynamic pieces of play equipment are going, and we are very excited! No spoilers -- unless you want to stop by and check out the progress yourself! The project is expected to take approximately 5-6 weeks. Here some of the steps needed:
install construction fencing
remove wood fiber surfacing and level out (grade) the site
demo existing play equipment. (For public safety, the swings area will be closed during construction and reopen along with the new playground.)
remove non-ADA pathways and pour new ADA-compliant concrete pathways and ramps
begin play equipment installation (this will take 2-3 weeks---there is a lot of fun equipment going in!)
install new wood fiber surfacing
clean up site, remove fencing
For questions or concerns, please contact Rita Schoch, Public Works Dept, at
or 415-927-5784.
This project was made possible by County of Marin, Measure A funding, as well as Developer Park fees.
The people have spoken - Option A "In the Woods" was the favorite
We conducted a survey in Spring 2016 and asked people to select their preferred theme for the new playground. Over 2/3 of the survey respondents* selected the nature-themed, post-and-deck playground structures.
Timing for the new playground project has tentatively been discussed for Fall 2016. The City is in the final stages of securing grant funding for this exciting new project. Check back for updates.
Piper Park Improvement Project (FY16-17)
Agendas & Minutes
Report an Issue
Central Marin Fire
Larkspur Library
Larkspur Recreation
Online Permits
Central Marin Police
Government Websites by
Arrow Left
Arrow Right
Slideshow Left Arrow
Slideshow Right Arrow


text:
Shaking hands with yourself is an amusing out-of-body experience. The illusion of having your stomach slashed with a kitchen knife, not so much. Both sensations, however, felt real to most participants in a Swedish science project exploring how people can be tricked into the false perception of owning another body.
In a study presented Tuesday, neuroscientists at Stockholm's renowned Karolinska Institute show how they got volunteers wearing virtual reality goggles to experience the illusion of swapping bodies with a mannequin and a real person.
"We were interested in a classical question that philosophers and psychologists have discussed for centuries: why we feel that the self is in our bodies," project leader Henrik Ehrsson said. "To study this scientifically we've used tricks, perceptual illusions."
It sounded intriguing enough for me to try it, though entering the laboratory on Monday, I was having second thoughts.
The first props I saw were two kitchen knives, three naked dummies and a prosthetic hand sticking out from behind a curtain.
"You have the right to say stop at anytime if you feel uncomfortable," said Ehrsson's colleague, Valeria Petkova, as she rubbed my left hand with electrolytic gel and attached electrodes to the middle and index fingers.
She assured me I was not in any danger. Still, a nervous tingle rushed through my body as she placed the headset over my eyes.
In the first experiment, the goggles were hooked up to CCTV cameras fitted to the head of a male mannequin, staring down at its feet. Through the headset I saw a grainy image of the dummy's plastic torso. I tilted my head down to create the sensation I was looking down at my own body.
At that point, it didn't feel very real. But when Petkova simultaneously brushed markers against my belly and that of the mannequin, the effect started setting in. As my brain processed the visual and tactile signals, I had a growing impression that the mannequin's body was my own.
That was good fun, until the gleaming blade of a bread knife entered my field of vision. Petkova slid it across the dummy's stomach, sending shivers down my spine and a pulse of anxiety through the electrodes. My heightened stress level was illustrated by a spike in a computer diagram shown to me after the experiment.
"Approximately 70-80 percent of the people experience the illusion very strongly," Petkova said.
Apparently, I was one of them.
The second experiment was more benign. This time my headset was connected to cameras mounted on a round hat that Petkova was wearing. We faced each other, extended our right arms and shook hands.
Now that was weird: I was supposed to have the sensation of shaking hands with myself. The illusion wasn't perfect as I couldn't quite recognize Petkova's grip as my own, even though that's what the goggles meant to make me believe.
Perhaps the session was too short. The actual study, in which 87 volunteers participated, consisted of repeated sessions that gradually provided more accurate data. The results were published in PLoS One, the online journal of the Public Library of Science.
The principle finding was that under certain conditions a person can perceive another body as his or her own, even if it is of an opposite gender or an artificial body.
"These findings are of fundamental importance because they identify the perceptual processes that make us feel that we own our entire body," the study said.
Ehrsson said the study built on a previous experiment known as the "rubber hand illusion" in which participants were manipulated to experience a rubber hand as their own.
Charles Spence, a professor of experimental psychology at the University of Oxford, said the Karolinska study was a "step up" from other research on the subject.
"This goes beyond other recent studies, where you've taken ownership of rubber hands and rubber legs," said Spence, who was not involved with the study.
His only concern was whether there might be any lasting effect on participants.
"The questions is what happens if you did it much longer? If you were in there for days and weeks. Would it be like something out of Total Recall?" Spence said, referring to the 1990 Arnold Schwarzenegger science fiction movie about a virtual vacation that turns into a nightmare.
Ehrsson suggested the findings could be applied in research on body image disorders by exploring how people become satisfied or dissatisfied with their bodies. Another possible application could be developing more advanced versions of computer games such as Second Life, he said.
"It could lead to the next generation of virtual reality applications in games, where people have the full-blown experience of being the avatar," Ehrsson said.


text:
Create a Website Account - Manage notification subscriptions, save form progress and more.
Show All Answers
Cleaning up groundwater, once it becomes contaminated, is not the answer to protecting our drinking water quality, because cleanup is rarely successful and is always very costly. On average, it is 27 times more costly to clean up contamination than it is to prevent it. Preventing groundwater contamination is the key to maintaining our health and ensuring the County remains a desirable place to live and work.
WHPA's under the Health Department's WHP Program cover large portions of South Bend, Lakeville, Mishawaka, Walkerton, North Liberty, and New Carlisle as well as unincorporated areas of the County. WHPA's are usually circular or elliptical in shape and may be several miles in length.
If a business is near a public water well or large water tower, there is a good chance it is in a WHPA. Some businesses have been informed by their public water supply company that they are in a WHPA. If you do not know if your business is in a WHPA, contact your local public water system or the Health Department to find out for sure.
Generally, if your business is within a Wellhead Protection Area (WHPA) and you have hazardous materials, petroleum products, or dry wells on your property you may need to obtain a permit. However, there are exclusions, exceptions, and special conditions that may affect whether you need a permit.
If a facility has dry wells or any of the following that contain hazardous materials or petroleum products a permit may be needed: - Above ground storage tanks - Drum storage areas - Improperly abandoned well - Major construction area - Motor vehicle salvage yards - Motor vehicle waste recovery well - Other threats as determined by the Health Department - Outdoor storage area - Rail or truck loading facility - Surface impediment - Underground storage tanks - Waste pile.
Even if a business is not required to obtain a permit, it is still subject to inspections and must report spills of hazardous materials to the Health Department.
The greatest risk of not complying with the Ordinance is that our groundwater supply may become contaminated and threaten the health of our residents. Our communities may no longer be considered healthy and desirable places to live and conduct business. We must ensure this does not occur.
No one would intentionally contaminate the groundwater, but sometimes our lack of knowledge or carelessness can be just as damaging. If contaminants do reach the groundwater, the responsible business would be required to pay for the cleanup. The costs can be very high. Failure to comply with the Ordinance may also subject businesses to enforcement action including fines up to $1,500 per day. Our goal is cooperation and compliance. If businesses, public water supplies, and the Health Department work together, we can maintain the quality of our drinking water supplies with minimal impact on business operations.


text:
Find the status of your in transit shipment
Please enter your tracking number(s)
Our Supply Chain division creates custom solutions for enterprise-sized organizations.
Discover what makes DHL Supply Chain the perfect fit as your outsourced logistics provider (3PL).
Business Only
Air and ocean freight, plus customs and logistics services with DHL Global Forwarding
Frequent Shippers
Ship regularly or often, learn about the benefits of opening an account
Our divisions offer a number of online tools for their business customers with DHL payment accounts. Contact your sales representative for login credentials.
The MyDHL+ platform allows DHL Express customers or guests to import, export, schedule a pickup and track shipments more quickly. Whether you're a small business or a global corporation, MyDHL+ makes it easy to navigate the complexities of international shipping.
The DHL eCommerce Web Portal allows business customers with regular shipping accounts to manage their shipments with DHL eCommerce. Key features include creating labels, tracking shipments, managing returns and access to performance reporting and analytics.
The DHL Global Forwarding Portal for all your logistics needs that gives you 360° visibility and full control over your shipments. Quote + Book, Track, Documents, Analytics - everything at your fingertips. Follow critical shipments and share information with colleagues, customers and suppliers. All in one place.
MySupplyChain is the DHL Supply Chain one-stop-shop for integrated warehouse and transportation insights – accessible anytime, from anywhere you are online. This tool provides our customers a near real-time view of inventory positions and warehouse level order statuses across the entire network, enabling you to turn newly-available, end-to-end supply chain operations insight into competitive advantage.
DHL Trade Automation Service (TAS) provides DHL Express customers the essential Customs information to understand international shipping requirements. Estimate landed costs, verify your shipment complies with import and export regulations, check destination and origin locations against embargo and restriction lists, and access essential trade documents.
LifeTrack is a validated, secure, and auditable system designed for Life Science & Healthcare's regulated supply chain, with a focus on temperature control and compliance. Thanks to the latest information technologies, it is DHL Global Forwarding's premier app to define, monitor and continuously improve transportation and storage before, during and after transit.
Whether it's across town or overseas, whether you're shipping an urgent document or a time-critical medical shipment, DHL Same Day offers a customized shipping solution designed to meet your needs.